CVE-2026-0300: Palo Alto PAN-OS Zero-Day Under Active Exploitation — No Patch Until May 13

Palo Alto Networks confirmed on May 6 that CVE-2026-0300 is being actively exploited in the wild. The vulnerability is a buffer overflow in PAN-OS’s User-ID Authentication Portal — also called the Captive Portal — and it allows an unauthenticated remote attacker to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls. No patch exists yet. Fixes are scheduled for May 13, 2026.

What the Vulnerability Does

The flaw lives in the Captive Portal component that handles initial user authentication before granting network access. By sending specially crafted packets to an exposed portal endpoint, an attacker triggers a stack-based buffer overflow that escalates directly to root-level code execution.

CVSS base score: 9.3 (Critical) when the portal is internet-accessible. It drops to 8.7 when access is restricted to trusted internal IP ranges — still High, but a meaningful reduction in blast radius.

Who Is Affected

• PA-Series and VM-Series firewalls running PAN-OS with the User-ID Authentication Portal enabled
• Not affected: Prisma Access, Cloud NGFW, Panorama appliances

Palo Alto reports “limited exploitation” currently, with observed attacks targeting firewalls where the Captive Portal was left exposed to the internet. That qualifier won’t hold for long. Perimeter firewalls are high-value targets, and pre-auth root RCE on a network edge device is the kind of primitive that threat actors race to weaponize.

Why This Is a P0

A successful exploit against a perimeter firewall doesn’t just compromise the firewall itself. An attacker with root access can:

• Intercept and decrypt traffic passing through the device
• Disable firewall rules and open arbitrary ports
• Use the firewall as a pivot point into the internal network
• Exfiltrate VPN credentials and authentication tokens stored in the device’s configuration

Palo Alto firewalls are among the most widely deployed enterprise network security appliances. This is not a lab vulnerability.

What to Do Right Now

Immediate mitigations (do these today):

1. Disable the User-ID Authentication Portal entirely if your organization doesn’t use captive portal authentication — most enterprises don’t need it internet-facing.
2. Restrict access to the portal to only trusted internal IP ranges. This brings the CVSS from 9.3 down to 8.7 and blocks the primary attack vector.
3. Block inbound traffic from untrusted networks to the Captive Portal service ports at the perimeter.
4. Enable threat intelligence feeds and monitor for anomalous inbound packets targeting the portal endpoint.

On May 13:

Apply the PAN-OS patch immediately when Palo Alto releases it. Do not wait for your next maintenance window.

Detection:

Check firewall logs for unexpected inbound traffic to the User-ID Auth Portal, unusual root-level process spawning, and any configuration changes you didn’t authorize. If you see signs of compromise before patching, treat it as a full incident response situation.

Context

This follows a string of high-severity Palo Alto vulnerabilities over the past 18 months, including several that were exploited within days of disclosure. Perimeter devices are now among the most consistently targeted entry points in enterprise intrusion campaigns — both by nation-state actors and ransomware groups who know that a firewall compromise gives them the keys to an entire network.

Patch on May 13. Disable or restrict the portal today.